46. The draft Bill would replace Chapter II of
Part I of RIPA, and also other statutory provisions about access
to communications data, with a new statutory regime making important,
controversial and far-reaching changes which would potentially
affect anyone who communicates by electronic means or who accesses
the internet. It would particularly affect the CSPs. It was therefore
unquestionably a prime candidate for wide-ranging consultation
at a stage when policy was still being formulated and could be
amended. This did not happen.

47. The draft Bill could impose substantial obligations
on all major CSPs operating in the United Kingdom, potentially
involving them in re-structuring of their systems, and certainly
requiring a substantial commitment of human, financial and technical
resources. Since they are to be allowed to recoup their expenditure
from the public purse, it would have been to their advantage and
to the taxpayer's if the policy could have been formulated to
allow the greatest benefits for the least expenditure.

48. In the course of three evidence sessions
we took evidence from 12 witnesses from the major United Kingdom
CSPs: BT, Virgin, Vodafone, Everything Everywhere, Telefónica
(O2); and several of the major overseas CSPs: Google, Hotmail,
Yahoo!, Facebook, Twitter, and Skype. The evidence we received
from the first five of these was to the effect that they had meetings
with Home Office officials, sometimes frequent and usually at
a high level, to discuss communications data, but that none of
these dealt specifically with policy formulation; some were before
the draft Bill was published (but not long before), and some were
post-publication. The evidence of Mark Hughes for Vodafone was
typical: "We have regular meetings with the Home Office at
a high level. We have had one meeting with the Home Office, formally,
post the drafting of the Bill, where we had the opportunity to
ask questions. Some of the questions they were not able to answer
for reasons of sensitivity." [49]

49. The position of the overseas based email
service providers was worse, with the first contact from the Home
Office often coming after they first heard that we had invited
these companies to give us oral evidence. Emma Ascroft told us
on behalf of Yahoo!: "We were invited after the Home Office
heard that we had been invited to give evidence to this Committee
. We had had no contact before. We met the Home Office in
March 2011 to discuss the Government's response to the 2009 consultation
on the changing communications environment, which Yahoo! UK responded
to. We asked for a meeting in September, at which point the Home
Office said there was no progress to report . there was no
further contact. As I said, the meeting we had with the Home Office
was three weeks ago. Again, it was very much presented to us as
our opportunity to ask the Home Office questions. It was not for
the Home Office to consult us on any options."[50]
This too was the position of the social network providers. On
behalf of Facebook, Simon Milner said categorically: "We
had no dialogue with the Home Office before the Bill was published
... we were never asked [for input] and we never provided it."
Similarly, Colin Crowell for Twitter: "We had one conversation
with the Home Office about two and a half weeks ago.[51]So we, too, were contacted after the
Bill had been published and had one phone conversation with them
about it."[52]

50. We asked Charles Farr about this apparent
lack of consultation. In the case of the United Kingdom CSPs he
said: "We have been meeting regularly with UK CSPs on communications
data over the past few years, and certainly in the run-up to the
Bill. I believe that we shared our broad thinking about what we
had in mind before the Bill was published, and we have followed
that up with more detailed sessions since the Bill appeared ...
but I fully accept that those discussions need to continue and
go into more detail as we get closer to the time when the Bill
is enacted, should it be so."[53]

51. In the case of the overseas providers, Mr
Farr told us that he had read their evidence "with a lot
of interest"; what he told us was almost the opposite of
what they said. He asserted that there had been a total of 30
meetings with them over a two-year period. He conceded that, because
they went back two years, not all of the meetings were on "the
minutiae of the Bill", but all of them were on communications
data.[54]
On the face of it, there is an inconsistency between these two
accounts. But our witnesses from the CSPs assumed, correctly,
that a Committee inquiring into a draft Bill would be asking about
meetings specifically on that Bill.

52. We asked the Home Office for details of the
meetings they had had with Everything Everywhere. They sent us
a list of 22 meetings which had been held since May 2009. The
last five took place after publication of the Bill. Of the other
17, 12 were described as "Forum with key CSPs", the
other five as bilateral with EE. One of these was with James Brokenshire
MP, the Parliamentary Under-Secretary of State responsible for
security. Officials explained that many of these meetings were
wider working group meetings at which communications data was
discussed "so that they [EE] may not recognise them all as
specific Bill meetings". When we put the list to Jonathan
Grayling, the Head of Law Enforcement Liaison at Everything Everywhere
who had given evidence to us, he confirmed that these meetings
did indeed form part of a series of regular meetings with the
Home Office at which they discussed communications data matters
generally and any outstanding problems. While he valued these
meetings, at some of them the draft Bill was only an agenda item,
usually consisting of a legislation update detailing timescales
and high level plans; the meetings did not involve the Home Office
asking for input to the detailed policy and content of the draft
Bill. The meeting with the Minister on 17 November 2011 (also
attended by James Blendis, Legal Vice President, Everything Everywhere)
was the first at which the Bill was discussed; this was at a very
high level, without going into any detail. The first meeting Mr
Grayling described as specifically on the draft Bill was on 2
April 2012 (a meeting not on the Home Office list). This of course
was only a month before the Queen's Speech, and two months before
publication of the draft Bill. Industry was first given sight
of the draft Bill, under embargo, on 7 June 2012, the week before
its publication; this was the first indication they had of how
the Bill was drafted.

53. What is absolutely clear to us is that the
regular meetings with EE and the other major CSPs would have been
an unrivalled opportunity for the Home Office to discuss with
them the evolving policy and content of the Bill, and to seek
their input on the many matters where their technical and general
expertise could have made a valuable contribution; and that this
opportunity was not taken. The draft Bill is the poorer for it.

54. Mr Grayling has told us: "Subsequent
to the publication of the Bill, consultation has increased dramatically,
and we have had a number of useful meetings at the Home Office
(documented in their list) and they have asked us to provide input
into the way the Bill is drafted and any wording/clause amendments
that we feel would be beneficial." We are glad to hear this;
but, of course, the consultation would have been a great deal
more valuable eighteen months ago.

55. Mr Farr told us: "Parliament and others
had a right to see the legislation before we discussed it in detail
with overseas providers."[55]
We do not accept this. Parliament has a right to see, on its introduction,
a Bill which seeks to implement as fully and clearly as possible
the Government's policy, however controversial that policy may
be. If the policy depends to a large extent on whether it can
be implemented by a few major international corporations, not
to consult them in the formulation of the detailed policy seems
unwise. We note that the Intelligence and Security Committee has
come to a similar conclusion.

56. The Home Office should
not have assumed that a consultation paper published in April
2009 could justify publication of draft legislation three years
later without further consultation with the public and with those
most closely affected by its proposals.

57. The evidence we received
shows that United Kingdom CSPs were not given any details about
the possible content of notices before the draft Bill was published,
overseas CSPs were not consulted about the draft Bill at all,
nor was there any further public consultation.

58. Before re-drafted legislation
is introduced there should be a new round of consultation with
technical experts, industry, law enforcement bodies, public authorities
and civil liberties groups. This consultation should be on the
basis of the narrower, more clearly defined set of proposals on
definitions, narrower clause 1 powers and stronger safeguards
which are recommended in this report. The United Kingdom and overseas
CSPs should be given a clear understanding of the exact nature
of the gap which the draft Bill aims to address so that those
companies can be clear about why the legislation is necessary.

59. Even though many of them
are prepared to cooperate on a voluntary basis, they should also
be told what obligations might be imposed on them. For many, their
willingness to cooperate voluntarily will be reinforced if there
is a statutory basis for the requirement.

60. Meaningful consultation
can take place only once there is clarity as to the real aims
of the Home Office, and clarity as to the expected use of the
powers under the Bill. CSPs should be consulted on the basis of
drafts of the specific notices which will be served on them; these
will have the detail of the obligations to be imposed on them,
and enable them to undertake a better assessment of feasibility
and of the resources and timescales involved.

Clause 1: What communications
data would be accessible?

THE BREADTH OF CLAUSE 1

61. The provision at the centre of the draft
Bill, on which all else depends, is clause 1. This is headed "Power
to ensure or facilitate availability of data". It allows
the Secretary of State by order to ensure that communications
data is available from telecommunications operators so that it
can be obtained by public authorities. The clause then sets out
the main ways in which it is expected that the power will be exercised.
The Home Office states[56]
that in practice an order is likely to impose requirements on
operators to generate all "necessary" communications
data for the services or systems they provide; to collect "necessary"
communications data, where such data is available but not retained;
to retain the data safely and securely; to process the retained
data to facilitate the efficient and effective obtaining of the
data by public authorities; and other matters.

62. These are wide, general requirements which
will be contained in an order. We have not seen a draft of such
an order, and we have been told that we will not be shown one.
But it is clear that the order will only be a framework. The specific
requirements will be imposed by secret notices by the Secretary
of State. The explanatory notes published with the draft Bill
explain: "The expectation is that notices will therefore
be individually tailored to each system or service (or class of
system or service) in respect of which there is an operational
need for communications data to be available from an operator.
The notices will describe, by reference to each service and system,
the description of data which must be retained, where the data
should be stored and, if necessary, how the data should be collected,
generated and processed."

63. A number of points stand out. First, the
only limitation on what communications data should be made available
is that it should be "necessary". Who decides what is
"necessary", and for what purpose, is not specified;
but as the word appears in the explanatory notes and not in the
clause itself, it provides no reassurance. Secondly, even if we
were able to see a draft order, it would be of limited assistance,
since the requirements themselves will be in notices agreed between
the Home Office and each relevant operator or, if not agreed,
imposed on them. Parliament will not even see, still less have
any control over, such notices. Thirdly, for the first time the
CSPs may have to generate data which they would otherwise not
have generated because there was no commercial need to do so.
This data must be retained for 12 monthslonger if it is
required for legal proceedingsand will be available to
the public authorities listed in the draft Bill or added to that
list by order, for the purposes specified in the Bill, and subject
to the safeguards in the Bill.

64. The power of the Secretary of State under
clause 1 has thus been made as wide as possible deliberately
so, for the reasons we explain later. But the Home Office told
some of the CSPs that they had no intention of exercising the
powers widely, as Sarah Hunter explained on behalf of Google:
"...the intent behind the Bill of the officials we met seemed
to be very narrow and reasonable. When we pointed out that the
powers within the Bill were much broader than that, they could
not quite address why there was such a gap."[57]

65. The Home Office told us almost from the outset
of our inquiry that they had no need to issue notices extending
to a wide range of data, and no intention of doing so; but, as
explained in Chapter 3, they would not tell us publicly what the
gaps were which the notices would be used to fill, because they
did not want to publicise what data they currently cannot access.
They accordingly made this clear only in a confidential annex
to their written evidence. Subsequently however, in the second
public evidence session with Home Office officials, Richard Alcock
said:[58]
"We have had discussions [with CSPs] about the additional
data types that we may wish those service providers to retain
there is certain information which is not stored routinely
by UK CSPs, in some cases web logs and in some cases IP data ...
In the majority of cases, fundamentally it is about those two
issues, but there is a broad range of other aspects." Charles
Farr endorsed this: "As Richard has said, one of the areas
where we are struggling is IP resolution. It is not the only
area; the web log issue is also important."[59] Subsequently Charles Farr repeated
this again, adding that there was also the issue of third party
data which needed to be addressed.[60]

66. We address later in the chapter the vexed
issue of whether these data types are all essential. Given the
wide anxiety raised by the breadth of clause 1, we pressed the
Home Office officials as to why it could not be narrowed to cover
only the gaps which currently needed to be filled. Mr Farr's answer
was: "The fundamental reason why we are nervous about limiting
clause 1 is future-proofing ... Because I genuinely believe that
no sooner will you get this legislation through than something
else will come up, given the pace of change in the communications
industry, which will create another gap, particularly if clever
people know that we have filled one area, and so now try to exploit
another. Future-proofing and flexibility are at the heart of the
language we have used in clause 1." He accepted that the
Home Office could and should look again at the drafting of clause 1:
"I still come back to the point that we can look again at
clause 1 and still have future proofing, because I think we need
to emphasise more clearly that the data types we are interested
in are only those which are relevant to these core questions."
We did receive from Mr Farr the important undertaking that Home
Office officials would look at clause 1 again, and advise
Ministers on whether it can be changed, enhanced or improved."[61]
We believe that it can indeed be changed and improved, by being
narrowed to cover specifically the gaps so far identified. An
undertaking, whether by officials or by ministers, that a power
will be used only to a limited extent, is of little value. Once
a power is on the statute book, it is available to be used, and
also to be misused or abused, at any time in the future. It is
hardly surprising that a proposal for powers of this width has
caused public anxiety.

67. We accept that, given the rapidity of technological
change and development in IT, within a relatively short time after
the implementation of any legislation the Secretary of State may
need to be able to order the retention of other categories of
data. We accept too that changes may need to be made from time
to time for other reasons. Neither of these justifies the retention
of clause 1 in its current form. We note that the Intelligence
and Security Committee has come to a similar conclusion and has
recommended that: "more thought is given to the level of
detail that is included in the Bill, in particular in relation
to the Order-making power. Whilst the Bill does need to be future-proofed
to a certain extent, and we accept that it must not reveal operational
capability, serious consideration must be given as to whether
there is any room for manoeuvre on this point: Parliament and
the public will require more information if they are to be convinced."

68. We attach in Appendix 7 a note considering
which Parliamentary procedures might be appropriate for making
such changes while still retaining Parliamentary control and public
confidence. Primary legislation should not in our view be ruled
out; even without having resort to emergency legislation, a department
like the Home Office with Bills every session should not have
much difficulty in securing any necessary changes within a relatively
short time. We can however understand the reluctance of ministers
to be obliged to have frequent resort to primary legislation.
Our recommendation is therefore for an order subject to the super-affirmative
procedure we describe in Appendix 7, allowing full consideration
by Parliamentary Committees. We caution however that this should
not necessarily be assumed to be always a speedier process than
primary legislation. Where the case for change can be made out,
Parliament will have a duty to attempt to expedite the Parliamentary
process, but even so, primary legislation could sometimes be faster.
Of course, the inclusion of an order-making power would not preclude
the Secretary of State from making use of primary legislation
if an appropriate opportunity were to arise.

69. The Home Office was able
to tell us of specific types of data that are currently not routinely
retained for business purposes by United Kingdom (and many overseas)
CSPs and which would be useful to law enforcement and other investigations.
It is the Home Office's intention to issue notices under the Bill
to ensure that an unknown number of CSPs retain these specific
types of data. The Home Office has however made clear to us that
it does not currently need the power under this legislation to
require other types of data be retained, and does not for the
present intend to issue notices going more widely (except to CSPs
which are not covered by the EU Data Retention Directive, which
might be asked under this legislation to retain for 12 months
data which they already create for business purposes). Clause
1 therefore should be re-drafted with a much narrower scope, so
that the Secretary of State may make orders subject to Parliamentary
approval enabling her to issue notices only to address specific
data gaps as need arises.

70. The Home Office has argued
that there is a case for keeping clause 1 wide because there may
be other data types that emerge from time to time which will be
important to law enforcement but will not be routinely retained
by CSPs for business purposes. We do not accept that this is a
good reason to grant the Secretary of State such wide powers now.
We do not think that Parliament should grant powers that are required
only on the precautionary principle. There should be a current
and pressing need for them.

71. We do however accept
that, depending on how the communications world develops, the
Home Office may in future need the power to require the retention
of other data types. Parliament and government both need to accept
that legislation that covers the internet and other modern technologies
may need revisiting and updating regularly. We have considered
how the Secretary of State might be given powers in the future
to allow her to address new and significant data gaps if and when
they emerge. The alternatives seem to be either primary legislation
on each occasion, or a power to amend clause 1 by order subject
to a super-affirmative procedure which would guarantee fuller
Parliamentary consideration than a standard affirmative order.

72. We attach in Appendix
7 a consideration of the relative advantages and disadvantages
of each course. On balance our preference is for an order subject
to the super-affirmative procedure. We recognise that this will
impose obligations on Parliament which it will have a duty to
discharge effectively.

IP ADDRESS RESOLUTION AND WEB LOGS

73. As outlined in paragraph 65, Home Office
officials eventually told us in public evidence that they would
like clause 1 to enable them to access two specific types of data:
subscriber data relating to IP addresses and web logs.

74. Subscriber data relating to IP addresses
is the information that makes it possible to trace who is using
an IP address at a given point in time. An IP address is a numerical
label assigned to a device connected to the internet (e.g. a computer,
smart phone or printer). The IP address of a device is not constant;
it may change frequently and be shared between several devices.
The originating IP address of a communication is routinely gathered
in many types of internet transaction, but if the CSP does not
hold information on which of its subscribers held which IP address
at a particular point in time it is very hard for law enforcement
authorities to prove an association between an action on the internet
and a particular individual. Not all United Kingdom providers
currently obtain all the data necessary to trace which subscriber
is using which IP address. During the course of our inquiry we
heard of various circumstances in which the lack of this data
has impeded investigations. We accept that if CSPs could be required
to generate and retain information that would allow IP addresses
to be matched to subscribers this would be of significant value
to law enforcement. We do not think that IP address resolution
raises particular privacy concerns.

75. We recommend that a narrower
clause 1 should allow notices to be served on CSPs requiring them
to generate and retain subscriber data relating to IP addresses.

76. The term "web logs" is used to
refer to a record of information that relates to a communication
between a user and the internet. This would include connections
to the world wide web (i.e. what websites a person has accessed)
and also contacts with other internet services, such as smart
phone applications.

77. The Code of Practice for the Acquisition
and Disclosure of Communications Data makes clear that this type
of data can be accessed by law enforcement agencies if it is held
by CSPs. It provides that anything before the first "/"
in a website address is considered to be communications data,
and anything after the first slash is considered to be content.
So the fact that a person visited www.nhs.uk is communications
data and could form part of a web log, but it would not be permissible
to record the fact that a person visited www.nhs.uk/conditions/depression.
Under the current law if a CSP keeps web log data for business
purposes then an order can require them to retain that data for
12 months, but if web logs are never generatedand most
CSPs do not generate them for business purposesthere can
be no requirement to make them available.

78. Sir Peter Fahy, Chief Constable of Greater
Manchester Police, told us that if it were possible to reconcile
IP address and subscriber information and also to identify which
websites were visited by a service user this would resolve the
data gap,[62]
and Peter Davies, Chief Executive of CEOP, agreed,[63]
but neither of them provided examples that proved the importance
of web logs or referred to cases that had been hampered by the
current lack of web log data. The one piece of evidence we saw
that went some way to proving a need was during our visit to the
Metropolitan Police Service,[64]
when officers used real life cases to illustrate how it is hard
to identify whom a suspect is communicating with if those communications
are conducted over the internet on a mobile phone. Those cases
showed that it would be useful to know if suspects were using
a website that allowed them to communicate with others because
the CSP running that website could then be asked for information
about who was contacted. To do this it would be necessary to know
the website visited and the IP address assigned to the suspect
at that time (so the website could be asked to check who the user
of that IP address contacted). This illustrates the Home Office's
case that the need for IP address information and the need for
web log data are connected.

79. The kinds of investigations where it is possible
to imagine web logs being useful include: enabling the identification
of internet services used by a suspect so that further communications
data requests can be made from those services; investigating the
web log associated with a sex offender to determine whether they
had accessed known child abuse websites; and investigating whether
a suspect had accessed a known terrorist website.

80. We have received considerable evidence expressing
concern at the idea of web log data being more widely retained
and made available to public authorities. A submission signed
jointly by representatives from Liberty, Justice, Privacy International,
the Open Rights Group, Big Brother Watch and NO2ID made the case
that web log data should not fall under the definition of communications
data, even though it does already, because it has the potential
to reveal considerable personal information about an individual:

"Throughout her oral evidence the Home Secretary
sought to articulate a distinction between the content of a communication
and the communications data which she characterised as the "who,
when, where, how" of a communication.... A record of the
addresses of websites visited patently reveals a great deal that
is substantive and potentially extremely personal about an individual's
life. An individual's browsing history is liable to betray his
or her political inclinations, state of health, sexuality, religious
sentiments and a huge range of other personal characteristics,
preoccupations and individual interests besides. We fail to see
that the distinction drawn by the Home Secretary can have any
meaning at all if communications data is deemed to include information
of this nature."

81. Retaining web log data would place massive
storage demands on CSPs and this would be costly. Some witnesses
also expressed concerns that the more information that is stored,
and the more sensitive the nature of that data, the greater the
chance of a security breach. Given the potentially sensitive
nature of web logs, a security breach could be particularly damaging
for the individuals whose data was lost. The secure storage of
communications data is addressed in Chapter 5. Briefly, it is
possible (given a willingness to accept the necessary cost) to
achieve a high degree of security of storage. But no one has claimed
or could claim that total 100 per cent security can be guaranteed:
there is bound always to remain the possibility of a breach, whether
as a result of skilled hacking or because of human error or misfeasance.

82. We accept that web logs are a type of communications
data from which significant inferences could be drawn about a
person's interests and, perhaps, activities. Web logs are at the
more intrusive end of the communications data spectrum and it
is at that end that the need for rigorous safeguards is most acute.
Safeguards are discussed in Chapter 5. We believe that the
SPoC and Designated Senior Officer system now in force, if operated
by properly trained and experienced staff, and subject to the
safeguards proposed in the draft Bill and the strengthening of
those safeguards we are recommending, can provide sufficient safeguards
against abuse within the system. The fact that web logs would
be accessible only by certain pubic authorities, that access would
be on a case-by-case basis and only when access was necessary
and proportionate, and the fact that access would be subject to
independent review, are also important.

83. One way of reassuring civil liberties groups
and more importantly the general public, while at the same time
satisfying the needs of law enforcement agencies, would be to
devise a definition of web service that covered only those that
could be used as a method of communication. This would cover websites
offering e-mail and other messaging services, but not websites
that simply supply information. CSPs could then be required only
to keep web logs in so far as they related to visits to communications
sites. This would however prevent, for example, a CSP from being
required to keep records of visits to a site thought to be accessed
by terrorists unless that site also enabled users to communicate
with each other, or to post messages. Whether or not this would
be technically and operationally feasible, and if it was what
the associated costs would be, is not something that we have had
time to explore.

84. Whether clause 1 should
allow notices that require CSPs to retain web logs up to the first
"/" is a key issue. The Bill should be so drafted as
to enable Parliament to address and determine this fundamental
question which is at the heart of this legislation.

85. The Home Office and law
enforcement agencies and (so far as we know) the intelligence
and security services think that access to weblogs is essential
for a wide range of investigations. The civil liberties organisations
argue that web logs are potentially a highly intrusive form of
communications data and that generating and storing web logs gives
rise to unacceptable risks to the privacy of individuals.

86. We are confident that
the safeguards in the draft Bill, together with the recommendations
we make to strengthen those safeguards, can provide a high degree
of protection against abuse of communications data or inadvertent
error by public authorities. We acknowledge that storing web log
data, however securely, carries the possible risk that it may
be hacked into or may fall accidentally into the wrong hands,
and that, if this were to happen, potentially damaging inferences
about people's interests or activities could be drawn. Parliament
will have to decide where the balance between these opposing considerations
should be struck.

87. In 2003, Parliament considered
the Code of Practice for the Acquisition and Disclosure of Communications
Data which included the guidance that web addresses up to the
first "/" should be considered to be communications
data. The presentation of this Bill provides an opportunity for
Parliament to review this controversial issue.

88. We also recommend that
the Home Office should examine whether it would be technically
and operationally feasible, and cost effective, to require CSPs
to keep web logs only on certain types of web services where those
services enable communications between individuals.

THIRD PARTY DATA

89. The Bill is intended to require CSPs operating
in the United Kingdom, whether based here or abroad, to comply
with retention orders served under clause 1 and disclosure requests
made by public authorities. As will be made clear in Chapter 6
there are likely to be significant problems with getting CSPs
based overseas to recognise the extra-territorial application
of United Kingdom legislation, and there will inevitably be cases
where overseas CSPs both refuse to retain the data that the United
Kingdom Government asks them to retain and refuse to disclose
the data that public authorities need. It is not clear, given
the level of informal assistance currently offered by the largest
overseas based CSPs to disclose information to investigators,
especially in urgent cases where lives are at immediate risk,
how significant a problem this actually is. Some overseas based
CSPs are likely to take a more pragmatic approach than others.
It is because of the variable approaches of the different overseas
CSPs to providing communications data that the Home Office argues
that power is also needed under clause 1(3)(c)(ii) to require
United Kingdom CSPs to store and disclose communications data
traversing their networks which relates to services from other
providers. This is commonly referred to as the third party provision.
A simple illustration is that using the third party provision
it would be possible to ask a United Kingdom broadband provider
to collect data on e-mails crossing its network when those e-mails
were sent using one overseas based e-mail provider to another
overseas based e-mail provider.

90. The third party provision has proved particularly
controversial both because of technical concerns and because,
as LINX put it, "The collection and processing of "third
party" communications data by network operators is a substantial
extension of their duties that is, in our opinion, materially
distinct from existing data retention requirements, amounting
to a complete novelty". Big Brother Watch agreed, saying
that if these provisions are passed UK CSPs could in future be
described as "private surveillance operations".

91. To understand the technical concerns it is
useful to understand a little about how third party data would
be collected. It would be necessary to place data probes within
a CSP's network and those probes would be programmed to generate
information from network links within the CSP. Deep Packet Inspection
(DPI) would be used to isolate key pieces of information from
data packets in a CSP's network traffic. The Home Office seemed
confident that this was technically possible. Other witnesses
questioned whether it is technically feasible to extract meaningful
and helpful information from third party services. One of the
primary technical challenges would be dealing with encrypted data.

92. Many internet services are encrypted; this
includes many of the major overseas based communications services
such as Gmail. Encryption is the basis of internet security and
companies encrypt their services to protect their customers. If
these companies are asked directly for communications data and
agree to supply it, whether under RIPA or following a request
under a Mutual Legal Assistance Treaty (MLAT), then they will
decrypt the information, extract the relevant communications data
and provide it to the requesting authority in an accessible format.
They told us however that if information about their service was
collected by another CSP they would not cooperate in helping decrypt
it. Sarah Hunter from Google explained:

"From a Google Inc perspective, we are very
confident about the security of our encryption. If a valid RIPA
request comes in or UK law enforcement goes through the MLAT,
receives a court order and in turn gets Gmail user data, we will
obviously provide that data decrypted. If it was to use a third-party
provider to gather the encrypted data, I think it very unlikely
that Google Inc would provide anyone outside Google Inc with that
key. That is simply because, as everyone said earlier, security
is our most important asset. Our relationship with our users is
predicated on trust. Without that, we have no business".[65]

93. Several witnesses questioned whether valuable
communications data could be retrieved from encrypted services.
Services encrypt not only content but much of the communications
data too, and the UK CSP whose network the encrypted service is
crossing will not be able to decrypt the package, nor could they
legally do so because to do so would be to intercept content.
As Everything Everywhere put it, "even if we were able to
decrypt, you would have to open the whole packet, and then you
are looking at the content".[66]
UK CSPs will not be able to hand over the whole encrypted package
to law enforcement or the Home Office because to do so would be
to hand over content.

94. Bob Hughes, Government Programme Manager
at Telefónica UK-O2, gave a helpful illustration of the
kind of data that a UK CSP would be able to provide about an encrypted
third party service:

"When we are talking about picking up third-party
data, we are now talking about gateway-to-gateway data. This is
very similar to a lot of letters having been passed to a delivery
box on one side of the network, put into a big courier delivery
box and crossing our network to a terminating distribution box
on the other side. Then, all those letters are taken out of the
box and sent on to their various places... All that we will see
when we look at those encrypted data are the two points of the
gateway. We are storing all of these communications, which are
just gateway-to-gateway. We cannot hand over the whole box because
we know that that includes content. We can give you only the piece
that is on the outside of the box that includes all the encrypted
data. Therefore, the value, by comparison with the letter and
its journey from A to B, is much reduced."[67]

95. Although this may sound of limited utility
Home Office officials said it could still be valuable to ongoing
investigations: "Encrypted data can still be very important
and can give you unencrypted chunks of data which are relevant
to the three questions which we are asking ourselves and to which
we come back all the time."[68]

96. One of the significant risks of the third
party provision is that it may actually lead to an increase in
the number of services that use encryption, and this could actually
reduce the amount of communications data available to in the United
Kingdom, a serious unintended consequence directly at odds with
the stated purpose of the legislation. Evidence that this was
a real risk came from Simon Milner, the Director of Policy for
UK and Ireland of Facebook, who explained:

"The security of our networks and the security
of how we store and look after customer data are fundamental to
our businesses. Therefore, when we are concerned that someone
else might be trying to intercept our data, we will move heaven
and earth to ensure the security of our network. It is a grave
concern to us that it might well be part of the new framework
that UK CSPs might be required to retain these data. One would
expect there to be not only implications for relationships in
the internet value chain but changes in behaviour by users. Facebook
users already have the ability to encrypt their traffic, and we
would expect many more UK users to choose to do so were that kind
of measure to be introduced".[69]

97. This issue was also highlighted in evidence
from Virgin, ISPA and Telefónica UK-O2.[70]

98. Microsoft questioned how a United Kingdom
CSP would identify which encrypted information it would be necessary
to store in order to comply with a third party provision notice:

"How can we guarantee that the CSP has identified
the right packets to be stored? Multiple providers, Skype included,
use obfuscation techniques precisely to avoid being detected by
deep packet inspection equipment. My question is a technical one:
how would they guarantee that they would be storing the correct
data under the order?"[71]

99. There are some instances of services that
not only encrypt but have specific software to ensure no communications
data is kept about their users, and no websites can identify their
users when they visit. For example, we took evidence from the
Tor Project, a not-for-profit organisation which encrypts and
redirects its users' communications to ensure they cannot be traced.
The Tor Project is used by people trying to circumvent national
censorship schemes, by victims of crime, by military personnel
working undercover, by journalists wishing to protect their sources
and by whistleblowers.

100. Encryption is not the only technical challenge
posed by the third party provision. We received evidence questioning
whether DPI technology could cope with the level of traffic that
moves across service provider networks. ISPA stated that "DPI
and such technology can be used by ISPs for legitimate traffic
management processes, but it does not follow it could be repurposed
to fulfil the requirements set out in the draft Bill. We are yet
to be convinced that current hardware can handle the volume of
traffic that moves across service provider networks at this level".

101. One of the key technical challenges would
be to programme DPI systems to isolate communications data information
from the content of messages sent. Even BAE Systems Detica, who
as manufacturers of DPI technology were confident of its capabilities,
admitted that it would be challenging to keep the DPI systems
up to date with changes that originating CSPs make to the underlying
formats and protocols used by those services.[72]
The pace at which CSPs change their systems (particularly proprietary
ones) can be very fast. This means that DPI system manufacturers
and CSPs would need to devote significant resources to monitoring
and updating systems both to maintain coverage and to operate
correctly. Microsoft confirmed this:

"We have a dedicated team involved in this obfuscation
constantly in order to protect the integrity of the communications.
At the same time, DPI equipment manufacturers have guys on the
other side trying to work out what we are doing. That will continue.
The point about it from the perspective of this draft Bill is
that it costs money to maintain DPI equipment. We do not just
buy once; there is a constant need to pay to have it updated in
order for it to perform. That is the key hereit is very
expensive".[73]

102. The concerns about the third party provisions
are not limited to questions about their technical feasibility.
UK CSPs would find it challenging to understand even non-encrypted
communications data belonging to other services. Under the current
system the Home Office works with CSPs to categorise their data,
agree what should be exempted as content, and then list the data
available in the "SPoC book". Only the company that
generates the data can give an informed opinion about how the
data should be categorised. A third party will not easily be able
to judge whether a law enforcement agency is right to categorise
a request for third party data as, for example, "subscriber
data", or even as data rather than content. The only data
type the third party could confidently identify is traffic data.
This was illustrated by Jonathan Grayling from Everything Everywhere:
"I think we could probably stand a pretty good chance of
identifying what is content and communications data in our own
data, because we understand it: we understand how our systems
work and how we interpret it. But to understand third-party data,
even if it is not encrypted, is going to provide challenges".[74]

103. The UK CSPs were also concerned about the
commercial implications of the third party provision. They rely
on good relationships with the main internet service providers,
many of whom are based overseas. If some of those providers choose
not to cooperate with this legislation but are aware that UK CSPs
may be ordered to collect data on their services, then this could
change the nature of their relationship. This was a significant
concern for the UK CSPs.[75]

104. The cost of constantly reprogramming DPI
probes to keep abreast of changes to third party services has
already been mentioned. This is not the only significant cost
concern. The cost of the DPI probes themselves would be significant,
and that and the costs of the large scale storage demands worry
the UK CSPs.[76]
Their concerns will be explored further in Chapter 7.

105. Given the significant concerns about the
third party provision some witnesses have called for it to be
dropped.

106. When the UK CSPs gave evidence to us in
September they stated that Home Office officials had given them
oral assurances that the third party provision would be invoked
only after the original service provider had been approached and
all avenues to get them to comply with requests for communications
data had been exhausted. The UK CSPs also said they had been given
assurances that they would not have to decrypt third party data.
These reassurances were important to them and they were very concerned
that there was nothing in the Bill to back-up the Home Office's
promises.[77]

107. We explored this issue with Home Office
officials in October and Charles Farr repeated the reassurance
he had given the UK CSPS:

"I think they [the UK CSPs] were under the misapprehension
that we might go to them to collect third-party data, even before
asking the third-party to cooperate with us. They were understandably
concerned if that were to be the case. Were it to be the case,
the costs would be rather different from what they otherwise might
be. I hope we have reassured them. I would repeat, if I may,
that it would be in extremis for us to go to them and ask for
the collection of third-party data. In the vast majority of cases
we do not expect to, and we have calculated the costs accordingly."[78]

"If they cannot distinguish communications data
from content they will not be required to retain it. We are not
asking for the storage of masses of encrypted data."[79]

108. When asked whether he agreed that the legislation
should reflect these assurances Charles Farr agreed to look at
it.[80] We note that
the Intelligence and Security Committee has recommended that "the
Home Office should have to demonstrate due diligence before resorting
to the use of DPI to collect communications data from overseas
CSPs" and that this should be reflected on the face of the
Bill.

109. The Home Office knows
that not all overseas CSPs will comply with retention notices.
It is for this reason that the notices issued under the order-making
powers in clause 1 may require UK CSPs to keep third party data
traversing their networks. UK CSPs are rightly very nervous about
these provisions. The Home Office has given an oral commitment
to UK CSPs that the Home Secretary will invoke the third party
provisions only after the original data holder has been approached
and all other avenues have been exhausted. The Home Office has
also given a commitment that no CSP will be asked to store or
decrypt encrypted third party data. These commitments should be
given statutory force.

Filtered data

110. Clause 14 provides a power to establish
filtering arrangements to facilitate the acquisition of communications
data. The Request Filter would be used for complex communications
data inquiries that cover several CSPs. As the Home Office explained,
"Internet communications services are technically different
from the telephone services of the past. The communications data
now needed to understand the 'who, how, when and where' of a single
communication may no longer be held by a single communications
provider".[81]Rather than a public authority having to submit separate
requests to several CSPs, it would submit one request through
the Request Filter which would then interrogate the multiple CSP
databases and automatically analyse the returns, providing investigators
with only the relevant data. CSPs could design their systems to
allow full automation of requests through the filter, or they
could decide to have staff check each request before allowing
the Request Filter to access data. It is important that CSPs have
this choice.

111. The Government's case for the Request Filter
is that it "is intended to enable law enforcement agencies
to continue acquiring complex communications data in a way that
minimises collateral intrusion".[82]
The Home Office sees the benefits as: minimising human error,
speeding up complex requests and minimising collateral intrusion.
The Request Filter is little different from the work that investigators
currently carry out comparing data from multiple CSPs when dealing
with complex enquiries. The difference is that it will be an automated
process which may be faster and less prone to human error, but
will require significant work to develop and will require the
Home Office to impose technical requirements on each provider
to ensure that data from the provider's systems is always returned
to the Filter in the same technical format, thus facilitating
easy data comparison.

112. The Home Office is at pains to assert that
the Request Filter is not a central database: "The legislation
makes clear that the Filter can only acquire and process communications
data to answer a specific public authority request. Once that
request has been answered the Filter will permanently delete all
the communications data it acquired".[83]
The Home Office emphasise this point because in May 2008, when
the last Government announced plans for legislation which would
have required communications data to be stored for a year in a
purpose-built database, the plans were heavily criticised, not
least by the two Parties that now make up the coalition Government.

113. It is however important to consider how
different the proposals for the Request Filter really are from
the previous Government's proposals for a central database. A
central database would have been one repository of communications
data provided by the CSPs but stored on a Government owned and
operated database. The Request Filter is a Government owned and
operated data mining device which, to work efficiently, requires
each CSP to maintain its own database of all its communications
data in a common format. Each CSP database will be able to be
accessed at any time by the Request Filter. So the same data is
being stored about the same people and it is being stored in databases
which are accessible to public authorities given powers under
the Bill. The difference is that instead of one database there
are many and they are privately owned. Although they are privately
owned the Government can stipulate what should be held on them,
for how long, and in what format it should be supplied. The differences
therefore are not as great as the Home Office suggests; the Request
Filter can be equated to a federated database.

114. There is also vigorous debate about whether
the Home Office is right to argue that the Request Filter minimises
collateral intrusion and thus is a tool in protecting privacy.
On the contrary, many witnesses see it as a threat to privacy.
For example LINX stated that:

"Clauses 14-16 establish a requirement that
communications data be processed and assembled by matching related
data from different operators, such that the relationships between
diverse data elements relating to a particular user are capable
of being machine-processed as such. In other words, the draft
Bill requires the functional equivalent of building communications
data profiles on every user, which will contain everything within
the definition of communications data, including time and geolocation
data".

115. LINX point out that it would be technically
possible to "perform profile searches of the following format:
'List all persons who are the designated user of a mobile phone
that was in Location (e.g. Trafalgar Square) at Time (e.g. noon
last Tuesday), and who have read any of the following websites
more than once in the past period (e.g year)' ".

116. There are also questions as to whether the
Filter amounts to a "general monitoring" obligation,
contrary to Article 15 of the EU E-Commerce Directive.[84]
This is not something we have had time to investigate but it
is an issue the Home Office should consider.

117. The Request Filter would make it technically
possible to perform profile searches on individuals. If it was
used in this way there is a risk that it could amount to general
monitoring, but there are safeguards to prevent this. Every request
to the Request Filter will have to go through the same authorisation
process set out in Chapter 2. This includes a requirement to explain
why the request is necessary and proportionate, and needs the
authorisation of a Designated Senior Officer. In addition the
draft Bill puts obligations on the IoCC to monitor the operation
of the Request Filter and examine the audit trails produced. This
safeguard is key, as Professor Peter Sommer told us:

"If these safeguards are not rigorously applied
and fully examined by the Interception of Communications Commissioner
there is a risk that that what is described as "request filtering"
becomes large-scale data mining; the necessity and proportionality
tests need to be applied not to just the individual data streams
as supplied by CSPs but to the likely effect when they are assembled
together."

118. We consider in the following chapter the
role of the IoCC in maintaining public confidence in the Filter.

WHO WILL DESIGN, PROGRAMME AND MAINTAIN
THE REQUEST FILTER?

119. The draft Bill makes the Secretary of State
responsible for setting up and maintaining any filtering arrangements,
and provides the power to transfer this responsibility to a designated
public authority. Day to day operation of the filtering arrangements
may be carried out by an approved body. Evidence from the Home
Office suggests that if the Secretary of State was to transfer
her powers to a designated public authority it would be to the
new National Crime Agency.[85]
The scope of the Bill does not limit who the day to day operation
can be transferred to, and some witnesses have expressed concern
that it could be GCHQ which is not accountable to the public or
to Parliament, although any transfer of functions would not affect
the Secretary of State's responsibility for the exercise of the
functions.

120. Some witnesses have questioned whether it
is appropriate that the Secretary of State should be responsible
for the operation of the Filter. Professor Peter Sommer argued
that "making this a function, direct or delegated, of the
same Secretary of State who also issues interception warrants
and orders under the draft Bill is surely a mistake; if there
is to be a credible and viable independent filtering agency much
more needs to be said about its resources and governance."

121. The Request Filter will be a very complicated
piece of technology. It will need to be constantly updated as
new CSPs are added, existing CSPs merge or CSPs change the kind
of communications data they have available and the format in which
it is held. Witnesses have expressed concern that the public sector
will not be able to attract and retain programmers of sufficient
skill to design and maintain a robust and effective filter. Professor
Peter Sommer wrote: "it will need resources, among them highly
skilled staff who are familiar with the law, the applicable technologies
and police investigative procedure - and who can also act independently.
They will almost certainly need high levels of security clearance.
In the private sector such people are likely to earn fairly high
income; moreover they will want some form of career structure
and stability. But there may not be a sufficiently consistent
flow of work to make this possible."

122. Whoever operates the
Request Filter will need significant expertise and staff at their
disposal. If CSPs update their system and the Request Filter is
not adjusted there is a risk that results will be incomplete,
rendering them useless. The Bill should be amended to say that
the Secretary of State may transfer her responsibilities for operating
the Request Filter to the soon to be established National Crime
Agency but not to other bodies. The National Crime Agency will
need appropriate resources and this should be reflected in the
revised cost/benefit analysis.

EVIDENTIAL QUALITY OF REQUEST FILTER
RESULTS

123. The Home Office's written evidence explains
that "It will be possible to manually check that the Filter
had functioned correctly (to ensure that the result is sound)
that there will be an audit trail of filter requests."[86]
We were not provided with information about how detailed this
audit trail will be and how the audit trail sits with the requirements
that "once the processing and filtering to answer a request
is complete all acquired communications data is immediately destroyed".
The quality of the audit trail is important because if Request
Filter results are to be used as evidence in criminal proceedings,
whether for the prosecution or the defence, they will need to
meet evidential standards. Several of our witnesses, including
LINX, questioned whether they would.

124. However the Director of Public Prosecutions
was not concerned that results from the Request Filter might not
meet evidential standards. His view was that although there would
be challenges the Filter arrangements were "workable provisions".[87]This was also the view of Lord Carlile
of Berriew QC[88]
and the IoCC.[89]

125. It is our view that the quality of the audit
trail will be key to ensuring that results from the Request Filter
meet evidential standards. It will be necessary for the prosecution
to prove that a result from the Filter is robust and reliable.
To do this they will need a clear audit trail that enables them
to re-run the data processing exercise in order to satisfy the
jury that the correct questions were asked of the Filter and that
the results were accurate. This will require data needed for criminal
proceedings to be held for more than 12 months; this includes
the collateral data that the Filter will have excluded from the
result it provided. Without that collateral data a request could
not be recreated.

126. The Request Filter will
speed up complex inquiries and will minimise collateral intrusion.
These are important benefits. On the other hand the filter introduces
new risks, most obviously the temptation to go on "fishing
expeditions". New safeguards should be introduced to minimise
these risks. In particular the IoCC should be asked to investigate
and report on possible fishing expeditions and to test rigorously
the necessity and proportionality of Filter requests.

Accessible by whom?

127. We explained in Chapter 2 that, of the many
public authorities currently allowed to access communications
data, the only ones listed in section 25 of RIPA are police forces,
SOCA (soon to be replaced by the new National Crime Agency) and
the Scottish Crime and Drugs Enforcement Agency (SCDEA), HMRC
and the intelligence and security services. "Police force"
and "intelligence service" are defined in section 81(1)
of RIPA. All other public authorities permitted to access communications
data are empowered to do so by order of the Secretary of State.
Clause 21(1) of the draft Bill follows exactly the same pattern,
save that the SCDEA do not appear in the list. Again, if any other
public authorities are to be added to the list, this would be
by order of the Secretary of State, subject to affirmative resolution.

128. We are satisfied that the four main users
currently listed in the draft Billthe police, SOCA, HMRC
and the intelligence and security servicesshould remain
on the face of the Bill as public authorities allowed access to
communications data. Together they currently account for 99% of
requests for communications data, and we have no doubt that they
should continue to have access to it, subject always to the enhanced
safeguards we suggest in Chapter 5.

129. We have considered whether there are other
authorities for which an equally strong case can be made, so that
they too should be listed in the Bill even though the use they
make of communications data is on a smaller scale. We believe
that there are two such bodies. The first is the Financial Services
Authority (FSA). In the last three years it has made 5,459 requests
for access to communications data,[90]
2,325 of them in 2011.[91]The matters it deals with are of increasing
importance. The second is the UK Border Agency (UKBA). It is not
listed as such in the current Order:[92]instead there is a reference to the
Home Office, but the persons designated to grant authorisations
are officials of the UKBA. They have made 10,103 requests in the
last three years,[93]
some dealing with key immigration offences such as people smuggling
and trafficking, in addition to more routine immigration crimes.
The UKBA too should in our view appear on the face of the Bill,
but under its own name rather than as the Home Office.

LOCAL AUTHORITIES

130. Of some 600 public authorities authorised
to access communications data, over 400 are local authorities,
which are permitted to acquire subscriber data or use data but
not traffic data. Trading standards departments are the principal
users of communications data within local authorities, although
the environmental health departments and housing benefit fraud
investigators also occasionally make use of the powers. Local
authorities enforce numerous statutes and use communications data
to identify criminals who persistently cheat consumers, the taxpayer,
deal in counterfeit goods, and prey on the elderly and vulnerable.
The environmental health departments principally use communications
data to identify fly-tippers.[94]

131. In 2011 141 local authorities notified the
IoCC that they had made a total of 2,130 requests, which is just
0.4% of all communications data requests submitted by public authorities.
Despite this, local authorities accounted for 9% of the reportable
errors. The evidence we received shows that errors by local authorities
cause public concern out of all proportion to the numbers involved.
This seems to be because examples of misuse or abuse of the system
are not only relatively frequent, but also particularly alarming.

BOX 6: Failure of authorisation by local
authorities

The IoCC found that in 2011 two local authorities
made a total of 52 requests which were not approved by a person
of sufficient seniority to act as a designated person, and were
therefore unlawful. In one of those authorities the same person
had acted as the applicant, SPoC and designated person, so that
there was a complete lack of scrutiny; in effect the requests
were self-authorised. In two instances in two different local
authorities the SPoCs processed and the designated persons approved
the acquisition of traffic data, which local authorities are not
permitted to acquire.

132. The IoCC reported one case where a local
authority used communications data in relation to a matter which
was not a criminal offence at all, and did not come close to being
a permitted purpose.

BOX 7: Use of communications data for
an unauthorised purpose

An allegation was made that a parent living outside
the catchment area of a school provided an address within the
catchment area to secure a school place. Communications data was
requested to provide evidence of residence and to confirm the
genuine address. The application stated that the Schools Admissions
Department would withdraw the place for the child if the allegation
was substantiated, but no criminal offences were specified. Nevertheless
the application was authorised and the data released.

133. This was a case which caused considerable
public disquiet; no fewer than seven of our witnesses referred
to it in written evidence.[95]What causes us still further disquiet is the statement from
the IoCC that "I was satisfied from this that the conduct
undertaken by the Council did not amount to wilful or reckless
use of the powers. It is clear that the Council went through a
considered thought process, that legal advice was sought prior
to submitting the application and that there were ongoing discussions
in relation to whether a prosecution was feasible." This
does nothing to allay our own anxieties. It scarcely needs legal
advice to work out that the support of a schools admissions policy
is not a proper use of communications data. Sir Paul Kennedy has
also argued that "The controls are perfectly in place. I
know there has been the odd incident about the school catchment
area, or something like that, but they are the odd incident and
if there is a criticismand I have said this in a report
beforeit is that local authorities do not always use these
powers as much as perhaps they ought to, to deal with the type
of offending that they are entitled and required to investigate,
and probably have no other means of investigating."[96]

134. The IoCC reports that, of the 141 local
authorities which notified him that they had made use of their
powers in 2011, 58% had made fewer than 10 requests. This plainly
contributes to the number and gravity of the errors: those processing
applications for access to communications data do so infrequently
and have relatively little experience of the system. When local
authorities were added to the list of relevant public authorities[97]
there was no suggestion that applications by them should be subject
to a different procedure from applications by other public authorities.
However the Coalition Agreement included the following undertaking:
"We will ban the use of powers in the Regulation of Investigatory
Powers Act (RIPA) by councils, unless they are signed off by a
magistrate and required for stopping serious crime."[98]
Section 37 of the Protection of Freedoms Act 2012, which came
into force on 1 November, added to RIPA two new sections 23A and
23B, the effect of which is that authorisations for local authorities
to access communications data do not take effect unless and until
approved by a justice of the peace in England and Wales, a sheriff
in Scotland, or a district judge (magistrates' courts) in Northern
Ireland.

135. There are thus historical reasons why, in
the case of RIPA, it is the Act which provides the conditions
subject to which local authorities can access data, even though
it is not the Act itself which grants them the right of access.
We can see no reason why the draft Bill should follow this pattern;
yet clause 11 specifies that judicial approval is needed for access
by local authorities, which are defined by clause 21(1), even
though they would have no right at all to access communications
data unless under the Bill, once enacted, the Secretary of State
made an order permitting such access.

136. If it is thought that local authorities,
or some of them, should have access to communications data, they
should follow the procedure we have suggested for all other public
authorities. We deal in the following chapter with the question
of the conditions which should apply to any access by local authorities.

137. Any public authorities
which make a convincing business case for having access to communications
data should, like the six we have specified in paragraphs 128
and 129, be listed on the face of the Bill. We expect this to
be a greatly reduced number when compared to the authorities currently
listed in the Regulation of Investigatory Powers (Communications
Data) Order 2010.

138. Any necessary changes
to this list should be made by order subject to the super-affirmative
procedure which includes the opportunity of scrutiny by the appropriate
Select Committee.

Accessible for what purposes?

139. Clause 9(6) of the draft Bill sets out the
purposes for which it is permissible to access communications
data. It reads:

(6) For the purposes of this section it is necessary
to obtain communications data for a permitted purpose if it is
necessary to do so

(a) in the interests of national security,

(b) for the purpose of preventing or detecting
crime or of preventing disorder,

(c) for the purpose of preventing or detecting
any conduct in respect of which a penalty may be imposed under
section 123 or 129 of the Financial Services and Markets Act 2000
(civil penalties for market abuse),

(d) in the interests of the economic well-being
of the United Kingdom,

(e) in the interests of public safety,

(f) for the purpose of protecting public health,

(g) for the purpose of assessing or collecting
any tax, duty, levy or other imposition, contribution or charge
payable to a government department,

(h) for the purpose, in an emergency, of preventing
death or injury or any damage to a person's physical or mental
health, or of mitigating any injury or damage to a person's physical
or mental health,

(i) to assist investigations into alleged miscarriages
of justice, or

(j) where a person ("P") has died or
is unable to identify themselves because of a physical or mental
condition

(i) to assist in identifying P, or

(ii) to obtain information about P's next
of kin or other persons connected with P or about the reason for
P's death or condition.

140. Purposes (a), (b) and (d) to (h) were in
RIPA as originally enacted. Purposes (i) and (j) were added in
2006 by Order[99]the
only such additions. Only purpose (c) is new. Schedule 2 to the
draft Bill would amend section 175 of the Financial Services and
Markets Act 2000 so that the FSA could not require CSPs to disclose
data for the purposes of investigations. Conversely, under paragraph
(c) data could be obtained to prevent or detect conduct which
would not necessarily constitute a criminal offence. We are satisfied
that this is a legitimate purpose, and it is for this reason that
we stated in paragraph 129 that a good case can be made for adding
the FSA to the list of public authorities on the face of the Bill.

141. Much the most common reason for requesting
and accessing communications data is "preventing or detecting
crime"purpose (b). "Crime" can of course
include trivial offences, and only the requirements of necessity
and proportionality can prevent communications data being used
for such crimes. But in evidence to us the Home Secretary was
referred to an article she had written in The Sun, where she had
said that "Only suspected terrorists, paedophiles or serious
criminals will be investigated under the Bill". She confirmed
that this was the "main purpose" of the Bill.[100]

142. The draft Bill has annexed to it the Home
Office memorandum on compatibility with the ECHR, and in particular
with Article 8, the right to privacy. Article 8 reads:

"(1) Everyone has the right to respect for
his private and family life, his home and his correspondence.

(2)There shall be no interference by a public authority
with the exercise of this right except such as is in accordance
with the law and is necessary in a democratic society in the interests
of national security, public safety or the economic well-being
of the country, for the prevention of disorder or crime, for the
protection of health or morals, or for the protection of the rights
and freedoms of others."

143. Article 8(2) is tantamount to an exhaustive
list of permitted purposes; no purpose which does not fall within
those words would be permissible. Two such purposes have been
added in the space of 12 years. It is now proposed to add a third.
We believe it is unlikely that a good case can be made for yet
further permitted purposes. Clause 9(7), like the existing provision
in RIPA, would allow the Secretary of State, by order subject
to affirmative resolution, to add yet more permitted purposes.
However the Home Secretary told us: "We have certainly got
no intention of setting out any permitted purposes beyond those
that are in the draft Bill."[101]

144. We sought the views of the House of Lords
Delegated Powers and Regulatory Reform Committee on clause 9(7),
and their conclusion was that "were a Bill to be introduced
containing the same power as in the draft, we would not necessarily
find it acceptable just because it derives from existing legislation."
We agree. We believe that any additions of further permitted purposes
should be by primary legislation, and that clause 9(7) should
be deleted.

145. The fact that there are ten permitted purposes
does not mean that relevant public authorities should have access
to communications data for all those purposes. Currently no authority,
not even any of the four core authorities, is permitted access
for all these purposes. The police do not need, and do not have,
permission to access data for tax purposes or to investigate miscarriages
of justice. Only HMRC need, and have, access for tax purposes;
only the Criminal Cases Review Commission, and its Scottish equivalent,
need and have access to investigate miscarriages of justice, and
they have access for no other purpose. The fire and ambulance
services routinely have access only in the case of life-threatening
emergencies. These are important limitations. Scrutiny of draft
orders which would add public authorities to the list of those
permitted access to communications data should ensure that access
is permitted only for those purposes which are strictly necessary.

146. Of the ten permitted
purposes in clause 9(6) of the draft Bill, seven were in RIPA
originally, two were added by order in 2006, and one is new. We
think it unlikely that there are any other as yet unidentified
purposes which could properly be added. The House of Lords Delegated
Powers and Regulatory Reform Committee has recommended that any
additions to this list should require primary legislation. We
agree. Clause 9(7), which allows the Secretary of State to add
further permitted purposes by order, should be deleted.

147. We are concerned that
the long list of permitted purposes for which communications data
can be requested adds to public disquiet about the breadth of
the Bill. While we do not make specific recommendations about
how this list could be shortened, we recommend that the Government
should consult on whether all the permitted purposes are really
necessary.